The FTC is also looking into the company's actions regarding potential data theft
News Story by Todd R. Weiss


MARCH 04, 2005 (COMPUTERWORLD) - Two top executives at credit and personal information vendor ChoicePoint Inc. are being investigated by the U.S. Securities and Exchange Commission for possible stock trading irregularities in connection with the company's recent disclosures that it sold the personal information of thousands of consumers to fraudulent businesses (see story).

The company also announced today that it will stop selling sensitive consumer information to businesses if there is no direct benefit to consumers. The move is designed to avoid future data thefts, the company said.

ChoicePoint will still provide personal information for home loans, car loans and government security inquiries.

In an 8-K report submitted to the SEC today, Alpharetta, Ga.-based ChoicePoint said the SEC is conducting an "informal inquiry" into recent stock trading by the company's CEO, Derek Smith, and its president and chief operating officer, Douglas Curling.

Asked about the inquiry, company spokeswoman Kristen McCaughan said that Smith and Curling had adopted prearranged stock sales plans last November that were set up to sell stock over six months. "These plans are typical for senior executives of public companies, and the plans were approved by the company's board of directors," McCaughan said. "We intend to cooperate and to provide requested information and documents to the SEC."

The sales took place after the company learned that data had been potentially accessed by fraudulent means but before that breach had been made public.

A separate investigation is also being launched into the data theft incident by the U.S. Federal Trade Commission (FTC), according to ChoicePoint's 8-K filing. The FTC probe is looking at the company's "compliance with federal laws governing consumer information security and related issues," the document states.

The FTC is now seeking information and documents regarding ChoicePoint's customer credentialing process and how the data theft occurred.

Last month, ChoicePoint reached an agreement with 19 state attorneys general to notify 145,000 people across the country whose personal information may have been stolen by identity thieves last year. The data thieves apparently posed as legitimate business customers to wrongly gain access to information about consumers.

California is the only state so far with laws requiring companies to notify residents in the event of a security breach involving personal financial data.

McCaughan said ChoicePoint has decided to change its policies on selling personal information because of the data theft. Personal data will no longer be sold to companies that don't use it according to guidelines stipulated in federal Fair Credit Reporting Act regulations.

"We are discontinuing the sale of any information that doesn't provide any specific benefit, such as car or house loans, or doesn't support criminal justice investigations," she said. "The company is committed to taking the necessary steps to protect consumers' personal data."

The incidents have renewed calls among lawmakers in Washington for a national data privacy law (see story).

ChoicePoint also disclosed in its 8-K filing that at least two lawsuits have been filed against the company in connection with the recent data theft incidents.

Source: